Aap-gateway: xss on aap-gateway
CVE-2024-10033

6.1MEDIUM

Key Information:

Vendor: Red Hat
Status: Red Hat Ansible Automation Platform 2.5 For Rhel 8; Red Hat Ansible Automation Platform 2.5 For Rhel 9
Vendor: CVE Published:; 16 October 2024

Summary

A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.

Affected Version(s)

Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.5.3-1.el8ap

Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.5.3-1.el9ap

References

https://access.redhat.com/errata/RHSA-2024:8534

vendor-advisoryx_refsource_REDHAT

https://access.redhat.com/security/cve/CVE-2024-10033

vdb-entryx_refsource_REDHAT

https://bugzilla.redhat.com/show_bug.cgi?id=2319162

issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Oct 16, 2024

Credit

This issue was discovered by Rick Elrod (Red Hat).

.